snoopdave commented on code in PR #240: URL: https://github.com/apache/roller/pull/240#discussion_r4573892385
########## skills/roller-release/references/atr.md: ########## @@ -15,22 +15,126 @@ See the License for the specific language governing permissions and limitations under the License. --> -# Evaluating Apache Trusted Releases +# Apache Trusted Releases -[Apache Trusted Releases](https://releases.apache.org) is an alternative release -workflow to evaluate with the PMC. Check its current documentation, availability, -project enrollment and supported packaging before adoption; this skill does not -pin a platform status or participating-project list. +Use [ATR](https://releases.apache.org/docs/) for Roller 7.x and later with local +builds and personal OpenPGP signing. ATR manages staging and publication. The PMC +approves the release; ATR checks supplement human verification. [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) +is a separate CI signing workflow requiring reproducibility and ASF approvals; +it is outside this process. Recheck current ATR documentation at release time. -Try a non-publishing rehearsal and establish how the chosen tool handles: +## Release prerequisites -- Source and convenience binary archives, signatures and checksums. -- Existing project distribution layout and KEYS handling. -- Candidate identity, vote evidence, cancellation and replacement. -- Promotion of the exact approved bytes and website coordination. -- Access control and the separation of private security coordination from - public release artifacts and messages. +Follow [Getting started](https://releases.apache.org/docs/getting-started) and +[Moving to ATR](https://releases.apache.org/docs/moving-to-atr): -Agree the workflow and ownership before a release deadline. Keep the evaluation -and any per-release decision in project planning records. Do not switch an active -release between tools without reconciling candidate identity and approval evidence. +- Sign in with ASF MFA. Confirm PMC membership or PMC designation as a release + manager. Verify the actual Roller project key, committee, repositories and + catalog; do not assume seeded data is correct. +- Confirm the signing public key is associated with Roller and is present in the + published committee KEYS file. Retain SVN-managed KEYS (ATR's default import + mode); update keys in SVN. +- Review [project configuration](https://releases.apache.org/docs/project-configuration): + metadata, release version policy, source checks, vote recipients and templates, + download page, announcement recipients and destination suffix. ATR's default + top-level project path can publish directly under `dist/release/<committee>/`, + while Roller uses `dist/release/roller-<major.minor>/v<version>/`. Set and Review Comment: 🤖Claude: fixed by your suggested wording (applied in 704bd3bd1): the prerequisites now give the full `dist/release/roller/roller-<major.minor>/v<version>/` layout and say to set and verify the destination suffix on the Finish page, for example `roller-7.0/v7.0.0`, noting that ATR adds the `roller/` committee directory itself. ########## skills/roller-release/references/atr.md: ########## @@ -15,22 +15,126 @@ See the License for the specific language governing permissions and limitations under the License. --> -# Evaluating Apache Trusted Releases +# Apache Trusted Releases -[Apache Trusted Releases](https://releases.apache.org) is an alternative release -workflow to evaluate with the PMC. Check its current documentation, availability, -project enrollment and supported packaging before adoption; this skill does not -pin a platform status or participating-project list. +Use [ATR](https://releases.apache.org/docs/) for Roller 7.x and later with local +builds and personal OpenPGP signing. ATR manages staging and publication. The PMC +approves the release; ATR checks supplement human verification. [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) +is a separate CI signing workflow requiring reproducibility and ASF approvals; +it is outside this process. Recheck current ATR documentation at release time. -Try a non-publishing rehearsal and establish how the chosen tool handles: +## Release prerequisites -- Source and convenience binary archives, signatures and checksums. -- Existing project distribution layout and KEYS handling. -- Candidate identity, vote evidence, cancellation and replacement. -- Promotion of the exact approved bytes and website coordination. -- Access control and the separation of private security coordination from - public release artifacts and messages. +Follow [Getting started](https://releases.apache.org/docs/getting-started) and +[Moving to ATR](https://releases.apache.org/docs/moving-to-atr): -Agree the workflow and ownership before a release deadline. Keep the evaluation -and any per-release decision in project planning records. Do not switch an active -release between tools without reconciling candidate identity and approval evidence. +- Sign in with ASF MFA. Confirm PMC membership or PMC designation as a release + manager. Verify the actual Roller project key, committee, repositories and + catalog; do not assume seeded data is correct. +- Confirm the signing public key is associated with Roller and is present in the + published committee KEYS file. Retain SVN-managed KEYS (ATR's default import + mode); update keys in SVN. +- Review [project configuration](https://releases.apache.org/docs/project-configuration): + metadata, release version policy, source checks, vote recipients and templates, + download page, announcement recipients and destination suffix. ATR's default + top-level project path can publish directly under `dist/release/<committee>/`, + while Roller uses `dist/release/roller-<major.minor>/v<version>/`. Set and + verify the destination suffix on the Finish page. Its supported tokens are + `{{PROJECT_KEY}}`, `{{VERSION}}`, and `{{MAJOR_VERSION}}`; do not assume a + custom path token. The ATR client's `--auto-publish` option does not honor the + configured path, so leave it off and publish manually from the reviewed Finish + page. Record the resolved path in the release work record. +- Use Email vote mode and the normal minimum of 72 hours. Roller may default to + Trusted vote mode; explicitly select Email when starting the vote. On the Review Comment: 🤖Claude: fixed. The Vote mode wording is your suggestion (applied in 704bd3bd1): set Vote mode to Email in the project settings and confirm it took effect before starting the vote, since the start-vote form offers no choice. For the non-blocking point, 9c48d725b repeats the auto-publish instruction in "Vote and replacement candidates" (leave **Automatically publish to SVN distribution area when this vote resolves** unchecked and publish manually from the reviewed Finish page). It stays in the prerequisites list too, and that bullet is re-wrapped. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
